Chainguard: Critical PHP vulnerabilities require updates
Affected components: Image builds & releases
Timeline of updates
- degraded
Updated Oct 21, 2026 at 4:40pm CDT
Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were disclosed by the PHP project on October 21 at 14:00 UTC. Patched Chainguard packages and images are available now. We recommend you pull and redeploy any image that includes PHP 8.2 through 8.5. You're patched if your image has php-8.2 8.2.34-r4, php-8.3 8.3.35-r4, php-8.4 8.4.26-r4 or php-8.5 8.5.11-r4 or later (frankenphp: 8.2.34-r3, 8.3.35-r2, 8.4.26-r2, 8.5.11-r2). The official 8.2.35, 8.3.36, 8.4.27 and 8.5.12 releases are also patched.
Images that bundle PHP, including wordpress, drupal, laravel, nextcloud-server, adminer, phpmyadmin, zabbix, renovate, privatebin and moodle, have been rebuilt with these versions. An earlier incident delayed image sync for some customer registries; as of 16:48 UTC every customer registry has the fixed standard PHP images (php, php-fips, frankenphp, phpmyadmin, phpmyadmin-fips), and most images that bundle PHP have synced. A small number of custom images are still being updated. Both CVEs are listed as fixed in the Chainguard and Wolfi security feeds, so refresh your scanner to clear patched images.
For how to check your image's SBOM and update, including Custom Assembly and digest-pinned images, see the knowledge base article: https://support.chainguard.dev/hc/en-us/articles/57552197172379-ACTION-REQUIRED-Update-Chainguard-images-with-PHP-for-CVE-2026-109618-and-CVE-2026-109619 (opens in new tab). If an image in your registry doesn't have the fixed version, contact Support. Next update by October 22, 16:00 UTC.
Archive proof
Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert.
How the archive is checked, and what it cannot prove.
Rewindex captured this after the last checkpoint; the next run () commits it.
Impact, status and times are the vendor’s own, as last archived.